FitSlot MCP Server

/** * Validation utilities */ import validator from 'validator'; /** * Validates if a string is not empty */ export function validateNotEmpty(value: string, fieldName: string): void { if (!value || value.trim().length === 0) { throw new Error(`${fieldName} cannot be empty`); } } /** * Validates if a value is a valid enum value */ export function validateEnum<T>(value: any, enumObj: T, fieldName: string): void { const validValues = Object.values(enumObj as any); if (!validValues.includes(value)) { throw new Error( `${fieldName} must be one of: ${validValues.join(', ')}` ); } } /** * Validates if a number is within range */ export function validateRange( value: number, min: number, max: number, fieldName: string ): void { if (value < min || value > max) { throw new Error(`${fieldName} must be between ${min} and ${max}`); } } /** * Sanitizes text input to prevent injection attacks * Uses comprehensive sanitization for security */ export function sanitizeText(text: string): string { if (!text) return ''; // Trim whitespace let sanitized = text.trim(); // Escape HTML entities to prevent XSS sanitized = validator.escape(sanitized); // Remove any remaining script-like patterns sanitized = sanitized.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, ''); // Remove potential SQL injection patterns sanitized = sanitized.replace(/(\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC|EXECUTE)\b)/gi, ''); // Limit length to prevent DoS if (sanitized.length > 10000) { sanitized = sanitized.substring(0, 10000); } return sanitized; } /** * Validates and sanitizes email address */ export function validateEmail(email: string, fieldName: string = 'Email'): string { const trimmed = email.trim(); if (!validator.isEmail(trimmed)) { throw new Error(`${fieldName} must be a valid email address`); } return validator.normalizeEmail(trimmed) || trimmed; } /** * Validates URL */ export function validateURL(url: string, fieldName: string = 'URL'): void { if (!validator.isURL(url, { protocols: ['http', 'https'] })) { throw new Error(`${fieldName} must be a valid HTTP(S) URL`); } }